AWS Certified Security – Specialty (Security Engineering on AWS)

Course Modules

1. Security Overview and Review

   • Understanding Security in the AWS Cloud.
   • Exploring the AWS Shared Responsibility Model.
   • Overview of IAM, Data Protection, and Threat Detection and Response.
   • Using MFA for enhanced protection.
   • Protecting the root user account and access keys.

2. Securing Entry Points on AWS

   • Utilizing multi-factor authentication (MFA).
   • Protecting root user accounts and access keys.
   • Understanding IAM policies, roles, and permission boundaries.
   • Logging API requests with AWS CloudTrail.
   • Hands-On Lab: Using Identity and Resource-Based Policies.

3. Account Management and Provisioning on AWS

   • Managing multiple AWS accounts with AWS Organizations and AWS Control Tower.
   • Implementing multi-account environments.
   • Using identity providers and brokers for AWS access.
   • Managing domain user access with AWS Directory Service and IAM Identity Center.
   • Hands-On Lab: Managing Domain User Access with AWS Directory Service.

Day 2:

1. Secrets Management on AWS

   • Overview of AWS KMS, CloudHSM, ACM, and Secrets Manager.
   • Creating multi-Region AWS KMS keys.
   • Encrypting secrets with AWS KMS keys.
   • Using encrypted secrets to connect to Amazon RDS across Regions.

2. Data Security

   • Protecting data at rest with encryption and access controls.
   • Using AWS services for data replication and archiving.

3. Security Considerations: Hybrid Environments

   • Identifying security points outside of a VPC.
   • Understanding common DoS threats.

4. Monitoring and Collecting Logs on AWS

   • Monitoring events and collecting logs with AWS CloudWatch.
   • Using AWS Config for resource monitoring.
   • Generating and collecting logs with AWS-native services.
   • Hands-On Lab: Server Log Analysis – Collecting Logs.

5. Processing Logs on AWS

   • Streaming and processing logs for analysis.
   • Utilizing AWS services to process logs stored in S3.
   • Hands-On Lab: Server Log Analysis – Processing Logs.

Day 3:

1. Securing Networking Communications

   • Applying security best practices to VPC configurations.
   • Implementing ELB as a protection point.
   • Protecting data in transit using certificates.

2. Out-Of-Region Protection

   • Understanding protection strategies for out-of-region resources.

3. Account Management on AWS

   • Managing AWS accounts effectively.

4. Security Considerations: Serverless Environments

   • Identifying security considerations in serverless architectures.

5. Secrets Management on AWS

   • Advanced techniques in managing secrets securely.

6. Automating Security on AWS

   • Leveraging AWS tools for security automation.

7. Threat Detection and Sensitive Data Monitoring

   • Utilizing AWS services for threat detection and monitoring sensitive data.